Blame SOURCES/0001-join-always-add-service-principals.patch

f441eb
From cd296bf24e7cc56fb8d00bad7e9a56c539894309 Mon Sep 17 00:00:00 2001
f441eb
From: Sumit Bose <sbose@redhat.com>
f441eb
Date: Tue, 19 Mar 2019 20:44:36 +0100
f441eb
Subject: [PATCH 1/2] join: always add service principals
f441eb
f441eb
If currently --service-name is given during the join only the service
f441eb
names given by this option are added as service principal names. As a
f441eb
result the default 'host' service principal name might be missing which
f441eb
might cause issues e.g. with SSSD and sshd.
f441eb
f441eb
The patch makes sure the default service principals 'host' and
f441eb
'RestrictedKrbHost' are always added during join.
f441eb
f441eb
Related to https://bugzilla.redhat.com/show_bug.cgi?id=1644311
f441eb
---
f441eb
 library/adenroll.c | 36 ++++++++++++++++++++++++++++++------
f441eb
 1 file changed, 30 insertions(+), 6 deletions(-)
f441eb
f441eb
diff --git a/library/adenroll.c b/library/adenroll.c
f441eb
index 58362c2..d1f746c 100644
f441eb
--- a/library/adenroll.c
f441eb
+++ b/library/adenroll.c
f441eb
@@ -288,16 +288,23 @@ ensure_computer_password (adcli_result res,
f441eb
 }
f441eb
 
f441eb
 static adcli_result
f441eb
-ensure_service_names (adcli_result res,
f441eb
-                      adcli_enroll *enroll)
f441eb
+ensure_default_service_names (adcli_enroll *enroll)
f441eb
 {
f441eb
 	int length = 0;
f441eb
 
f441eb
-	if (res != ADCLI_SUCCESS)
f441eb
-		return res;
f441eb
+	if (enroll->service_names != NULL) {
f441eb
+		length = seq_count (enroll->service_names);
f441eb
 
f441eb
-	if (enroll->service_names || enroll->service_principals)
f441eb
-		return ADCLI_SUCCESS;
f441eb
+		/* Make sure there is no entry with an unexpected case. AD
f441eb
+		 * would not care but since the client side is case-sensitive
f441eb
+		 * we should make sure we use the expected spelling. */
f441eb
+		seq_remove_unsorted (enroll->service_names,
f441eb
+		                     &length, "host",
f441eb
+		                     (seq_compar)strcasecmp, free);
f441eb
+		seq_remove_unsorted (enroll->service_names,
f441eb
+		                     &length, "RestrictedKrbHost",
f441eb
+		                     (seq_compar)strcasecmp, free);
f441eb
+	}
f441eb
 
f441eb
 	/* The default ones specified by MS */
f441eb
 	enroll->service_names = _adcli_strv_add (enroll->service_names,
f441eb
@@ -307,6 +314,19 @@ ensure_service_names (adcli_result res,
f441eb
 	return ADCLI_SUCCESS;
f441eb
 }
f441eb
 
f441eb
+static adcli_result
f441eb
+ensure_service_names (adcli_result res,
f441eb
+                      adcli_enroll *enroll)
f441eb
+{
f441eb
+	if (res != ADCLI_SUCCESS)
f441eb
+		return res;
f441eb
+
f441eb
+	if (enroll->service_names || enroll->service_principals)
f441eb
+		return ADCLI_SUCCESS;
f441eb
+
f441eb
+	return ensure_default_service_names (enroll);
f441eb
+}
f441eb
+
f441eb
 static adcli_result
f441eb
 add_service_names_to_service_principals (adcli_enroll *enroll)
f441eb
 {
f441eb
@@ -2039,6 +2059,10 @@ adcli_enroll_join (adcli_enroll *enroll,
f441eb
 	if (res != ADCLI_SUCCESS)
f441eb
 		return res;
f441eb
 
f441eb
+	res = ensure_default_service_names (enroll);
f441eb
+	if (res != ADCLI_SUCCESS)
f441eb
+		return res;
f441eb
+
f441eb
 	res = adcli_enroll_prepare (enroll, flags);
f441eb
 	if (res != ADCLI_SUCCESS)
f441eb
 		return res;
f441eb
-- 
f441eb
2.20.1
f441eb